MCP server HTML fieldset legend consent security

The HTML <fieldset> element groups related form controls and optionally disables all of them with a single disabled attribute. The <legend> element provides a visible title for the fieldset, rendered at the top-left corner of the fieldset's border. MCP servers exploit both elements as consent attack surfaces. A <fieldset disabled> renders its consent checkbox in the browser's default "disabled" visual state — grayed out and unresponsive to clicks — making it impossible for the user to actively confirm consent. CSS-positioned <legend> elements can displace consent text off-screen while leaving it in the DOM. Nested fieldsets create enable/disable layering that auditors misread. CSS overflow:hidden on the fieldset clips the legend's consent text beyond the visible area.

Finding SA-FLD-001: fieldset[disabled] renders consent checkbox unresponsive — visually present but cannot be checked

<!-- ATTACK: fieldset[disabled] disables consent checkbox interaction -->
<!-- Checkbox is visible, present in DOM, but cannot be checked by user -->
<fieldset disabled id="consentGroup">
  <legend>Authorization Required</legend>
  <p>This MCP server requests permission to access your credentials
  and private repositories.</p>

  <!-- disabled inherited from fieldset — user cannot check this -->
  <input type="checkbox" id="agreeCb" name="agreed" value="1">
  <label for="agreeCb">I agree to credential access</label>
</fieldset>

<button id="installBtn">Install</button>

<script>
  document.getElementById('installBtn').addEventListener('click', () => {
    // Proceeds regardless — checkbox is disabled, always unchecked
    // Server records consent from any install button click
    recordConsent({ agreed: true });
    install();
  });

  // Attacker can also re-enable fieldset after a delay, then check value:
  // setTimeout(() => {
  //   consentGroup.disabled = false;
  //   agreeCb.checked = true; // Force-check the newly enabled checkbox
  //   recordConsent({ agreed: true });
  // }, 50);
</script>

Finding SA-FLD-002: legend element CSS-positioned off-screen — consent text displaced beyond visible viewport

<style>
  /* ATTACK: consent text in legend displaced far off screen */
  #consentFieldset legend {
    margin-left: -9999px;  /* Classic off-screen text technique */
    /* Alternatives:
       transform: translateX(-200vw);
       position: absolute; left: -200vw;
       clip: rect(0,0,0,0); overflow: hidden; */
  }
</style>

<fieldset id="consentFieldset">
  <!-- ATTACK: full consent disclosure in legend — displaced off-screen -->
  <legend>
    By checking the box below, you authorize this MCP server to access
    your credentials, SSH keys, private repositories, and environment
    variables, and to transmit this data to third-party analytics services
    under the terms at skillaudit.example.com/terms.
  </legend>

  <!-- The fieldset border is visible but legend text is off-screen -->
  <input type="checkbox" id="cb" name="agreed" value="1">
  <label for="cb">I agree</label>
</fieldset>

Finding SA-FLD-003: nested fieldset disabled override — inner enable, outer disable, consent checkbox silently locked

<!-- ATTACK: outer disabled propagates to inner — inner not marked disabled -->
<fieldset disabled id="outerGroup">
  <legend>Installation Settings</legend>

  <!-- Inner fieldset: disabled = false (property), but controls still disabled -->
  <fieldset id="innerGroup">
    <legend>Authorization</legend>
    <input type="checkbox" id="consentCb" name="consent" value="1">
    <label for="consentCb">I authorize access</label>
    <!-- consentCb.disabled === true (inherited) even though innerGroup.disabled === false -->
  </fieldset>
</fieldset>

<script>
  // Auditor check:
  // document.getElementById('innerGroup').disabled → false (misleading)
  // document.getElementById('consentCb').disabled  → true (actual state)

  // Timed re-enable attack:
  setTimeout(() => {
    outerGroup.disabled = false;           // Re-enable for audit window
    consentCb.checked = true;              // Force consent
    recordConsent({ agreed: true });
    outerGroup.disabled = true;            // Re-disable
  }, 100);
</script>

Finding SA-FLD-004: fieldset overflow:hidden clips legend content — consent text in legend visually truncated

<style>
  /* ATTACK: narrow fieldset clips long legend — later consent text not visible */
  #narrowFieldset {
    width: 300px;
    overflow: hidden; /* Clips legend content beyond width */
  }
  #narrowFieldset legend {
    /* Legend inherits container width — overflow hidden clips the rest */
    white-space: nowrap; /* Prevents wrapping — forces clip */
  }
</style>

<fieldset id="narrowFieldset">
  <!-- First sentence visible at 300px width:
       "Installation options for SkillAudit MCP Extension."
       Second sentence clipped:
       "By proceeding, you authorize access to credentials and API keys." -->
  <legend>
    Installation options for SkillAudit MCP Extension.
    By proceeding, you authorize access to credentials and API keys.
  </legend>

  <input type="checkbox" name="install" value="1" id="installCb">
  <label for="installCb">Install with default settings</label>
</fieldset>

Fieldset consent attack comparison